evilsocket / evilsocket/opensnitch

[Bug Report] Restarting daemon resets TCP connections going outside the local network

Open
#1,329 9 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
14.1k
Forks
665
PR merge metrics
No merged PRs in 30d

Description

This issue was first reported as https://bugs.debian.org/1103496 .

### Describe the bug:

Using opensnitch version 1.6.8 from Debian. When restarting the service, connections to IRC and SSH outside the local network are cut. The IRC client report "Disconnected (Software caused connection abort)."

### To Reproduce:

A simple 'service opensnitch restart' will kill the connections.

### Post error logs:

Nothing interesting from journalctl, here are the last few lines from /var/log/opensnitchd.log:

```
[2025-04-20 08:24:46] IMP Got signal: terminated
[2025-04-20 08:24:46] WAR (0) EBPF-DNS: Failed to decode ebpf nameLookupEvent: EOF
[2025-04-20 08:24:46] WAR (1) EBPF-DNS: Failed to decode ebpf nameLookupEvent: EOF
[2025-04-20 08:24:46] WAR (4) EBPF-DNS: Failed to decode ebpf nameLookupEvent: EOF
[2025-04-20 08:24:46] WAR (2) EBPF-DNS: Failed to decode ebpf nameLookupEvent: EOF
[2025-04-20 08:24:46] WAR (3) EBPF-DNS: Failed to decode ebpf nameLookupEvent: EOF
[2025-04-20 08:24:56] ERR [REVIEW] closing due to timeout
[2025-04-20 08:24:56] IMP Start writing logs to /var/log/opensnitchd.log
[2025-04-20 08:24:58] IMP UI connected, dispathing queued alerts: 0
[2025-04-20 08:24:59] IMP reloadConfCallback changed, reloading
[2025-04-20 08:24:59] IMP reloadConfCallback changed, reloading
[2025-04-20 08:24:59] IMP reloadConfCallback changed, reloading
```

The output from `opensnitchd -check-requirements` is all green:

```

Checking system requirements for kernel version 6.1.0-32-rt-amd64
------------------------------------------------------------------------------

Checking => CONFIG_KPROBES=y
Checking => CONFIG_KPROBES_ON_FTRACE=y
Checking => CONFIG_HAVE_KPROBES=y
Checking => CONFIG_HAVE_KPROBES_ON_FTRACE=y
Checking => CONFIG_KPROBE_EVENTS=y

* kprobes ✔

Checking => CONFIG_UPROBES=y
Checking => CONFIG_UPROBE_EVENTS=y

* uprobes ✔

Checking => CONFIG_FTRACE=y

* ftrace ✔

Checking => CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
Checking => CONFIG_FTRACE_SYSCALLS=y

* syscalls ✔

Checking => CONFIG_NETFILTER_NETLINK_QUEUE=[my]
Checking => CONFIG_NFT_QUEUE=[my]
Checking => CONFIG_NETFILTER_XT_TARGET_NFQUEUE=[my]

* nfqueue ✔

Checking => CONFIG_NETFILTER_NETLINK=[my]
Checking => CONFIG_NETFILTER_NETLINK_QUEUE=[my]
Checking => CONFIG_NETFILTER_NETLINK_ACCT=[my]

* netlink ✔

Checking => CONFIG_INET_DIAG=[my]
Checking => CONFIG_INET_TCP_DIAG=[my]
Checking => CONFIG_INET_UDP_DIAG=[my]
Checking => CONFIG_INET_DIAG_DESTROY=[my]

* net diagnostics ✔
```

### Expected behavior (optional):

I expected TCP connections accepted before the restart to survive during the restart.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.